Core Contracts

Summary

The _withdrawFromVault function in the LiquidityPool contract has an incorrect parameter ordering when calling the curveVault.withdraw function. Specifically, the owner parameter is incorrectly passed as the receiver, and the receiver parameter is incorrectly passed as the owner.

Vulnerability Details

The withdraw function in the LiquidityPool contract is designed to withdraw assets from the Curve Vault and transfer them to the specified receiver. However, the parameters passed to the curveVault.withdraw function are incorrect:

• Expected Behavior:

  • assets: The amount of assets to withdraw.

  • receiver: The address to receive the withdrawn assets.

  • owner: The address whose shares are being burned.

  • max_loss: The maximum acceptable loss in basis points.

  • strategies: An optional array of strategies to withdraw from.

• Actual Behavior:

  • The receiver is incorrectly set to address(this) (the contract itself).

  • The owner is incorrectly set to msg.sender (the caller).

This misalignment means that:

1. The withdrawn assets will be sent to the contract itself (address(this)) instead of the intended receiver (msg.sender) or more likely will not work at all.

Impact

This issue results in funds being withdrawn incorrectly or the transaction failing entirely, leading to the following risks:

1. User Withdrawals May Fail – Since the owner is set to the contract itself (msg.sender) instead of the user (address(this)), users may not receive their funds upon withdrawal.

2. Locked Funds in the Contract – If the withdrawal succeeds but assets remain in the contract, users might need a separate transaction to claim their funds, adding unnecessary complexity and potential security risks.

Tools Used

Manual review

Recommendations

Refactor the code in the following way:

Also the problem here is that we need to have two function for withdraw, one that we are going to use to withdraw during ensureLiquidity with receiver msg.sender and another one with receiver reserveRTokenAddress during rebalance.